It’s true that in most cases a private international organization will be doing the scanning. But part of the proposal is that it’ll be compulsory for online service providers to report any communications that are flagged up as suspicious to the EU, which is a governmental organization (both are pretty bad tho)